HIGH8.7npm
GHSA-xf7r-hgr6-v32p· CVE-2026-3304Multer vulnerable to Denial of Service via incomplete cleanup
Modified: 9/10/2026
package
npm/multer
pkg:npm/multer
MEDIUM5.3npm
GHSA-3p4h-7m6x-2hcm· CVE-2026-5038Multer vulnerable to Denial of Service via incomplete cleanup of aborted uploads
Modified: 6/17/2026
MEDIUM5.3npm
GHSA-3pph-fpjx-jg34· CVE-2026-88932multer vulnerable to Denial of Service via orphaned disk writes on aborted uploads
Modified: 9/28/2026
HIGH7.5npm
GHSA-44fp-w29j-9vj5· CVE-2025-47935Multer vulnerable to Denial of Service via memory leaks from unclosed streams
Modified: 9/10/2026
HIGH7.5npm
GHSA-4pg4-qvpc-4q3h· CVE-2025-47944Multer vulnerable to Denial of Service from maliciously crafted requests
Modified: 9/10/2026
HIGH7.5npm
GHSA-535w-7cp7-47q4· CVE-2026-82333multer vulnerable to Denial of Service via oversized array index in field names
Modified: 9/8/2026
HIGH8.7npm
GHSA-5528-5vmv-3xc2· CVE-2026-3520Multer Vulnerable to Denial of Service via Uncontrolled Recursion
Modified: 9/10/2026
HIGH7.5npm
GHSA-72gw-mp4g-v24j· CVE-2026-5079Multer vulnerable to Denial of Service via deeply nested field names
Modified: 6/17/2026
HIGH7.5npm
GHSA-fjgf-rc76-4x9p· CVE-2025-7338Multer vulnerable to Denial of Service via unhandled exception from malformed request
Modified: 7/17/2025
HIGH8.7npm
GHSA-g5hg-p3ph-g8qg· CVE-2025-48997Multer vulnerable to Denial of Service via unhandled exception
Modified: 9/10/2026
HIGH7.5npm
GHSA-q7qp-rjg7-q26m· CVE-2026-113872multer vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardown
Modified: 10/23/2026
HIGH7.5npm
GHSA-qfvm-cv95-jqjf· CVE-2026-77037multer vulnerable to Denial of Service via file descriptor leak on aborted uploads
Modified: 9/8/2026
LOW3.7npm
GHSA-qvfw-j98x-7q72· CVE-2026-77063multer vulnerable to file size limit bypass via async fileFilter race condition
Modified: 9/8/2026
HIGH8.7npm
GHSA-v52c-386h-88mc· CVE-2026-2359Multer vulnerable to Denial of Service via resource exhaustion
Modified: 9/10/2026
HIGH7.5npm
GHSA-wc9g-mqfw-jrwm· CVE-2026-77078multer vulnerable to Denial of Service via crafted multipart field names
Modified: 9/8/2026